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WHO ARE WE? 


* Wesley Neelen 

* Hacker 

* OSCP / OSCE 

* 8* years of experience 

* Internet of Things security 
* Rik van Duijn 

* Hacker 

* OSCP / OSCE 

* 8* years of experience 

* Malware analysis 
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DISCLAIMER: NO SMART TRAFFIC EXPERTS ©. WE DO USE BICYCLES 
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INTRODUCTION TO SMART TRAFFIC 


Creating a platform to exchange information: 
* Road signs 


* Parking status 
* Traffic status 


* Traffic light systems 


* Road users 
* Cyclist, cars, trucks, emergency vehicles ... 
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Our research focus 
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In the Netherlands: 
* 17+ million citizens - 22.8 million bicycles 
* 35,000 kilometres cycling infrastructure 
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TA MINUTE, YOU ARE LETTING ME TALK TO TRAFFIC LIGHTS? 
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ONGOING PARTNERSHIPS 
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* Comfort 

* Traffic flow 
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ONGOING PARTNERSHIPS 


Goal: 
* Safety 
* Comfort 
* Traffic flow / Available on the iPhone 
0 App Store 
Apps to connect: 


* Cyclists, decreases the time to green 
* Trucks, a green flow 
* Emergency vehicles, instant green and notify others 


ANDROID APP ON 


X Google play 
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ONGOING PARTNERSHIPS 


Goal: 
* Safety 
* Comfort 


* Traffic flow «€ 


Apps to connect: 
* Cyclists, decreases the time to green 
* Trucks, a green flow 
* Emergency vehicles, instant green and notify others 


VRI's are being replaced for iVRİ's (EN: TLC to iTLC) er р | 1 be | 
* VRI controls all traffic lights at 1 intersection ג‎ ia שב‎ Pe 
* ifor Intelligent | T | 


* Currently: 513 across the Netherlands (5500 VRI's total) 


Image credit: https://en. wikipedia. ora/wiki/Traffic_light_control_and_coordination 
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HOW ARE THINGS CONNECTED 7 


(Current state. Future: e.g. car-to-car, 5G-enabled.. :-s) 
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CLOUD SERVICES 
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ETSI CAM OBJECTS 


* ETSI - European Telecommunications Standards Institute 
* |TS Intelligent Transport Systems 


* CAM - Cooperative Awareness Message (EU) 
* BSM - Basic Safety Message (US) 
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ETS! CAM OBJECTS 


* Contents 
* Basic Container 
* Position 
* Station type* 
* HF Container 
* High speed data 
* Speed 
* Yaw 
* etc 
* LF Container 
* Static / slow changing data 
* Lights 
* Path history 


CAM 
ITS PDU header Basic HF Container LF Special vehicle Container (Conditional) 
Container Container 
(Conditional) Public Transport Container 
or 
Vehicle HF Vehicle LF 


Container or 


Container or. 


Other containers. 


Special Transport Container 
or 


Other containers 
(not yet defined) 


Image credit: ETSI (https://www.etsi.org/deliver/etsi en/302600 302699/30263702/01.03.01 30/en 30263702v010301v.pdf) 
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Root CA 
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Enrolment PY Authorization 
Authority (EA) Authority (AA) 


” enrolment T Veritcanon/authorization 


қ еее Есіме d 24 
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Authorization 


Certificates. 
Bootstrap Certificate. 
(self signed) 


Canonical ID 
& publickey 


Secured message 


АТ, 


Figure 11: РКІ architecture 


Image credit: ETSI (https://www.etsi.org/deliver/etsi 15/102900. 102999/102940/01.03.01. 60/15. 102940у010301р.ра/) 
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ITS SECURITY wet 


Standard describes signing messages MARO P Authority (RA) 
* CAM has a station type maz 


Certificate contains SSP and ITS-AID ыт E 
* Intelligent Transport System Application ID NETS 


во 


* Describes basic permissions " ENN E. - 
* Service Specific Permissions m — -—— 
: Е I a. OK 
* Describes specific permissions such as: оз ^ xo Ат, 
3 = 


* Emergency container 
* Dangerous good container 


Figure 11: РКІ architecture 


An incoming signed CAM is accepted by the receiver if the certificate is valid 
land the CAM is consistent with the ITS-AID and SSP in its certificate. 


Image credit: ETSI (https://www.etsi.org/deliver/etsi_ts/102900_102999/102940/01.03.01_60/ts_102940v010301p.pdf) 


ZOLDER CN ii 


ITS SECURITY 


* Security Standards exists 

* Implementation requires a central certificate authority and infrastructure 

* Even then it might be good to monitor the messages sent across infrastructure. 

* There are research trying to detect abuse: https://github.com/josephkamel/F2MD 


Basic Plausibility Consistancy Module (Data-Centric) 


Legacy Module 


Error Tolerant Module 


Position Plausibility | | Speed Plausibility 


Range Plausibility 


udden Appearance] 


Position Gonsistenoy [Speed Consistency 


P-S Consistency 


Intersection 


> Faste can — rated AT requests 


P-H Consistency Kalman Filter Position Speed Prediction 


> Na Report md 


Image credits: (https://docbox.etsi.org/Workshop/2019/201903 ІТ5//5/5Е5510М02/5Ү5ТЕМХ KAISER.pdf) 


and (https://github.com/josephkamel/F2MD) 
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value basicContainer 
stationType cyclist, 
referencePosition ( 


* Android application for cyclists 


* Decompiled: CAM objects over MQTT latitude 5100001, 

* Hard time imitating: ASN and Protobuf longitude 50ххххх, 
positionConfidenceEllipse { 

* Let's use (for the first time) ©: F a l DA semiMajorConfidence unavailable, 


semiMinorConfidence unavailable, 


. / semiMajorOrientation unavailable 
* Hooked the CAM publisher function: } 
altitude { 
altitudeValue 4000, 
altitudeConfidence unavailable 
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REAL LIFE IMPLEMENTATION 1 - MODIFYING CAM 


const playback 


51. 
"51 за; +18 


1 


camp. onExampleLocationchangeEvent.implementation = function (v 


for (ind Ə; index <= playback.length-1; index++) + 


var long = parseFloat(playback[index].split(‘;')[@]-spl 
lat = parseFloat(playback[index].split(';')[e].split(' 
parseFloat(playback[in split(';')[4]); 
bearing = parseFloat(playback[index].split(';')[5]); 


accuracy = parseFloat(playback[index].split(';')[1]); 
altitude = parseFloat(playback[index].spli 
v.mExampleLocation.value.getAndroidLocation().setSpeed(spe 
mpleLoc 8 getandroidLocation().setBearing(bearing); 
y. mExampleLocatic 'tLatitude(long); 
v.mExampleLocation.v 
impleLocatio 
v.mExampleLocation. 
this.publishCam(v.mExamp 


onsole.log(v.mExamp ation.val 
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Every new MOTT connection seen as a new cyclist: 
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REAL LIFE IMPLEMENTATION - 2 
* Android application for cyclists 


* Burp suite -> POST requests with position 


* Backend converting our input to CAM? 
* No way to distinguish cyclists (no auth) 
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Other traffic at the intersection 
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If i run the script... 2 


é 


. and with the script on our laptop 


we can make it turn green — | 


WRONG? 


Beer 
KESTEREN " 
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BRABANTPARK 


SPORTPARK 


GINNEKEN 
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CONCLUSION 
KEY ISSUE: No Signing 


Despite specification in ETSI standard. 


Allows to: 

* Remotely influence a cycling traffic light; 
* Or all cycling lights in a city at once; 

* Imitate cyclists only (for now) 
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CONCLUSION 
KEY ISSUE: No Signing 


Despite specification in ETS! standard. 


Allows to: 

* Remotely influence a cycling traffic light; 
* Or all cycling lights іп a city at once; 

* Imitate cyclists only (for now) 


Impact: 

* Limited: safety systems stay intact (no accidents) 

* Causing annoyance due to unnecessary red light 

* Funny, however: annoyance by red lights can lead to road rage 


Ongoing: responsible disclosure process 
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KEY ISSUE: Na Signing 


Despite specification in ETSI standard. 


Г GET ONE CHANCE 
LEMENT THIS CORRECTLY 


FOUNDATION FOR THE FUTURE 
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1. Implement some form of 
authentication 


2. Monitor unexpected / implausible 
behavior at the backend 


3. Block abuse 
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Q&A 


Thursday, August 6th, 2020 
13:30 - 14:00 (Pacific Time) 


Or contact us directly: 


| GWESLEYNEELEN WV ORIKVOUIIN 


